CVE-2021-37363

ALTO 7.8CVE-2021-37363 · Published 26/10/2021 · updated 17/06/2026

In breve

CVE-2021-37363 è una vulnerabilità ALTO (CVSS 7.8) che riguarda gestionale open (gestionaleopen).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 76.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
gestionale open gestionaleopen	`= 11.00.00`	No fix yet

Description

An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.

References

exploit-db.com/exploits/50449 · Exploit
gestionaleopen.org · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free